First of all, you shouldn’t do this. But in case you are hell bent on making a mess the following steps will allow you to modify objects that Active Directory would otherwise block you from changing.

The tl;dr is that when the directory believes we are in schema update mode, most modifications are going to slide on through.

  1. Make sure your account is currently a member of Schema Admins
  2. Launch LDP.exe and bind to a DC.
  3. After connecting and binding, navigate to the browse menu and select the “Modify” option.
  4. Leave the DN blank, type schemaUpgradeInProgress into the Attribute field and in the values field type 1
  5. Click the Add operation and then click the enter button.
  6. Click the Run button.


Once you’ve done whatever horrible thing you need to do remember to return the directory to non-Schema Update mode.

  1. From LDP.EXE, change schemaUpdateInProgress back to a value of 0, and then click Run
Blog Logo

Chad Duffey



Chad Duffey

Blue Team -> Exploit Development & things in-between

Back to Overview